If you've turned on two-factor authentication and think you're done, I get it — that used to be true.
It isn't anymore, and it's worth fifteen minutes to understand why, because the gap is exactly where a lot of real account takeovers happen now.
What MFA actually stops:
A password alone is one lock. MFA adds a second one — usually a code from an app or a tap on your phone — and it stops the vast majority of automated password-guessing and credential-stuffing attacks cold. If someone just has a leaked password from an old breach, MFA shuts the door.
What it doesn't stop:
Adversary-in-the-middle phishing. This is the one that matters most right now. Instead of a normal fake login page, attackers use a reverse-proxy phishing kit that sits between you and the real service. You type your password, then your one-time code — and the kit quietly relays both to the real site in real time, then steals the session cookie that comes back. The attacker never needed your password long-term. They just needed a few seconds of a live, already-approved session.
MFA fatigue (push bombing). An attacker who already has your password triggers a flood of push-approval notifications to your phone, often late at night, betting that irritation or a half-asleep tap approves one of them.
Weak recovery flows. If "forgot password" can be reset through a support call or an SMS code to a SIM-swapped number, MFA on the main login doesn't matter.
What actually holds up:
Phishing-resistant MFA — passkeys and FIDO2 security keys. These work differently: the cryptographic signature they produce is bound to the real origin domain. A lookalike domain literally cannot get a valid response out of one, no matter how convincing the fake page looks. This is the single biggest upgrade you can make.
Number-matching on push approvals, if your organisation supports it — it kills blind-tap approval.
Never approve a prompt you didn't start. Deny it, then change your password and check recent sign-in activity.
MFA is still one of the strongest things you can turn on. It's just not the finish line anymore — treat it as one layer, not the whole defense.
I go deeper into exactly how the AiTM relay attack works step by step, with the full defense checklist, here: MFA: The Second Lock That Hackers Can Still Pick
Stay Secure! Stay Happy!!
